Contactless wireless security systems, including automotive keyless entry systems, such as Passive Entry/Passive Start (PEPS) systems and near field communication (NFC) payment systems, face a threat referred to as a “relay attack”, which permits a vehicle or payment information to possibly being stolen without the owner's awareness.
A relay attack typically involves two individuals, although any number of individuals may be utilized, working in cooperation with each other. Each of the two individuals carries a device (referred to as an attack kit) capable of receiving a signal, in the case of a PEPS system, from either the vehicle or the vehicle's key fob and forwarding the received signal to the other individual after amplifying the signal. In one scenario, the individuals follow the vehicle and its driver. The driver stops at, for example, a store or a restaurant. Individual-1 stands adjacent to the parked vehicle while individual-2 follows and stands next to the owner of the vehicle (who may be inside the store or restaurant or any other location away from the car). Individual-1 initiates a door unlock operation by touching the car handle, pulling the car handle, or pushing a button on the car, which normally requires a valid key fob to be within a certain distance of the door. Upon initiating the unlock operation, the vehicle broadcasts a wireless signal intended for reception by a valid, nearby key fob.
The attack kit carried by individual-1 picks up the wireless signal being broadcast by the vehicle and relays the signal (such as physical layer signals or encrypted bit streams) to the attack kit of individual-2. Upon receiving the signal from the attack kit of individual-1, the attack kit of individual-2 replicates the signal in the format commensurate with the key fob and transmits the replicated key fob-compliant signal to the key fob carried by the vehicle's owner (which presumably is within sufficient range of individual-2); thereby waking up the key fob. The key fob which receives the wireless signal and cannot distinguish individual-2's attack kit from the vehicle itself considers the attack kit carried by individual-2 as the vehicle, and, as it is configured to do, transmits a wireless response signal to authenticate the key fob to the vehicle. This response signal is then received by the attack kit of individual-2 which relays the signal back to the attack kit of individual-1. The attack kit of individual-1 receives the response and replicates a wireless signal compatible with the vehicle. The vehicle's wireless communication system cannot distinguish a wireless signal from the attack kit of individual-1 from the key fob itself and performs the designated operation (e.g., unlocks the door). A similar relay attack is possible on payment systems utilizing NFC technology.